From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:48580)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1WKOJi-000874-D2
	for Qemu-devel@nongnu.org; Mon, 03 Mar 2014 03:33:50 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1WKOJZ-0005sg-Vt
	for Qemu-devel@nongnu.org; Mon, 03 Mar 2014 03:33:42 -0500
Received: from mail-qa0-x233.google.com ([2607:f8b0:400d:c00::233]:61990)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1WKOJZ-0005sK-Mw
	for Qemu-devel@nongnu.org; Mon, 03 Mar 2014 03:33:33 -0500
Received: by mail-qa0-f51.google.com with SMTP id cm18so914252qab.24
	for <Qemu-devel@nongnu.org>; Mon, 03 Mar 2014 00:33:31 -0800 (PST)
Sender: Paolo Bonzini <paolo.bonzini@gmail.com>
Message-ID: <53143E50.5060205@redhat.com>
Date: Mon, 03 Mar 2014 09:33:20 +0100
From: Paolo Bonzini <pbonzini@redhat.com>
MIME-Version: 1.0
References: <6777CD901FD53644B082307CD745FB8326AC9348@SACEXCMBX02-PRD.hq.netapp.com>	<530AC892.2080109@ozlabs.ru>	<5311D2DD.4090904@ozlabs.ru>
	<531251CB.10102@redhat.com> <5313E1AD.5050409@ozlabs.ru>
In-Reply-To: <5313E1AD.5050409@ozlabs.ru>
Content-Type: text/plain; charset=KOI8-R; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] e1000 memory corruption in guest OS
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Alexey Kardashevskiy <aik@ozlabs.ru>, "Hoyer, David" <David.Hoyer@netapp.com>, "Qemu-devel@nongnu.org" <Qemu-devel@nongnu.org>
Cc: "Moyer, Keith" <Keith.Moyer@netapp.com>, "Best,
	Tish" <Tish.Best@netapp.com>

Il 03/03/2014 02:58, Alexey Kardashevskiy ha scritto:
> On 03/02/2014 08:31 AM, Paolo Bonzini wrote:
>> Il 01/03/2014 13:30, Alexey Kardashevskiy ha scritto:
>>>>>
>>>>> Corrupted DMA buffer is 0x e00000 -- 0x7f15c313f000.
>>>>> The e1000 packet is at  0x12ffac2 -- 0x7f15c313eac2.
>>>>>
>>>>> (0x7f15c313f000 - 0x7f15c313eac2) = 0x53e which is less than 0x5aa and
>>>>> (0x5aa - 0x53e) = 0x6c bytes get corrupted.
>>>>>
>>>>> I see here buffer overrun from e1000 and I suspect that your patch just
>>>>> hides this problem. What did I miss?
>>>
>>> Ping, anyone?
>>
>> You missed that this is a Xen-specific problem.  Xen maps things a page at
>> a time, so address_space_map/unmap/rw can operate only on a small part of
>> the requested [address, address+length) range.
>
> Sorry, I am not following you here. Does KVM map things not page-aligned?

Look in exec.c for xen_enabled().  Xen's implementation of 
address_space_map/unmap is completely different.

>> So there is no overrun in e1000.  The patch is incomplete, because it fixes
>> only address_space_rw, but the problem is indeed in exec.c.
>
> So you know what the problem is? We have a bunch of bugreports against
> e1000 breaking things...

This one had been reported and fixed already.

Paolo